The protection of personnel, hardware, programs, networks, and data from physical circumstances and events.
126
votes
12answers
18k views
How is an ATM secure?
I'm curious why an ATM computer is considered secure. The general adage of "If an attacker has physical access to my machine, all bets are off," seems to not apply in this circumstance (since ...
76
votes
13answers
6k views
Why do we lock our computers?
It's common knowledge that if somebody has physical access to your machine they can do whatever they want with it1.
So why do we always lock our computers? If somebody has physical access to my ...
28
votes
12answers
3k views
Is it possible to turn a computer into a bomb?
I know this newspaper article sounds absurd. Even if a machine is compromised we (should) have hardware safe guards in all our devices to prevent the software from damaging the hardware. But is it ...
26
votes
3answers
815 views
How can you judge the physical security of a padlock?
I recently learnt to pick locks. Eager to test out my skills, I tried picking a padlock I'd been using on a secure storage box for a number of years, and found that it only had one pin - I can get ...
26
votes
7answers
5k views
Are powerline ethernet adapters inherently secure?
I have 2 Zyxel PLA407 powerline adapters. Router is downstairs connected to one adapter, other adapter is upstairs about 30 feet away connected to a desktop. I have a house, not an apartment or ...
19
votes
9answers
613 views
What's a good way to trigger a hidden 'distress signal' in instant messaging?
Here's the scenario:
Alice and bob use Off-the-record messaging to communicate over IM. The have:
Encryption
Authentication
Deniability
Perfect forward secrecy
They communicate after ...
18
votes
6answers
796 views
How to secure a WiFi network?
What do I have to do to secure a WiFi network? Is there any best practices?
I have been recommended to use WPA2 encryption on the router, is that enough? What can I do to improve the security even ...
16
votes
7answers
1k views
Protecting critical state infrastructure from the aftermath of a nuclear blast
Countries rely on computer infrastructure for a huge percentage of communications and military management, as well as utilities like electricity. Unfortunately, nuclear attacks release massive ...
16
votes
7answers
788 views
Securing the security guy's home office: what should we do?
I read an article in the latest InfoSecurity magazine (an infosec trade rag by Elsevier) saying that us security professionals aren't necessarily taking the correct steps to protect our own home ...
16
votes
1answer
295 views
High-frequency noise deterrents
I've found that walking past certain boutique stores in my city that some places have installed very loud high-frequency noise generators. These cause a fair amount of discomfort for passers by that ...
16
votes
4answers
487 views
Securing an area both physically and technically
I work for a commercial printing company, and we're beginning to get a couple jobs labeled "High Security". Essentially this means that if any pictures/information/files/etc. of the product were ...
15
votes
5answers
983 views
What is the most security benefit of a clean desk policy?
Starting to study for Security+ using Darril Gibson's book I took the pre-exam and one of the latest questions is “What is the most security benefit of a clean desk policy?”
The choices are:
...
14
votes
2answers
1k views
How can vending machines be hacked? And how can I prevent it?
I am developing a vending machine and want to make it secure.
In a comment to my previous question, @Polynomial said "Vending machines (and similar devices) can often be pwned via buffer overflows on ...
13
votes
2answers
350 views
What is the difference between types of motion sensors?
So i understand there are a number of different motion sensor technologies out where including Active Infrared (AIRs), Passive Infrared (PIRs), Microwave motion sensors and Ultrasonic motion sensors.
...
13
votes
2answers
854 views
Methods for protecting computer systems from physical attacks
I am interested in cost effective and creative ideas for detecting physical attacks against computer systems. This includes, but is not limited to Tamper Evident security measures.
Consider the ...
13
votes
3answers
249 views
Risks of Mullions in High Security Areas
I have a storage space full of information assets. The room itself is sound; there are no windows, the walls go all the ceiling, and there is only a single entrance with two good stout doors and high ...
12
votes
4answers
800 views
How do you prevent physical backups from being stolen?
I'm sure, by now, we're all aware of the need to encrypt backup disks, but what can be done on the physical security side of things to prevent backups from being stolen or damaged?
Particularly:
...
12
votes
2answers
228 views
Establishing routines on what to do if a PC gets stolen
I need to establish routines for how to handle theft of PC equipment, specifically laptops and stationary machines. Also I need to figure out how to make the consequences of stolen equipment minimal.
...
10
votes
3answers
2k views
How can I prevent someone from accessing a Windows XP system via boot disk?
Apparently a computer system protected by a a login password, e.g. Windows XP, can be easily hacked by someone with physical access to it using methods like this one:
...
10
votes
5answers
293 views
Resources for physical security questions
What are good resources for the physical security questions that IT organizations face? Like best practices for locks and seals on servers and kiosks, personnel access mechanisms and policies, ...
10
votes
3answers
2k views
Can law enforcement track a criminal through dynamic IP address?
I ask because a week ago my home was broken into and, among other things, my iMac computer was stolen. I am desperate to get it back because it has all the pictures of my daughters from the last ...
10
votes
1answer
232 views
Slot machine segfault: what can we determine?
We walked into a casino and saw this near the entrance. I don't have a specific question, but is there anything that would be interesting to share and explain from the image?
9
votes
2answers
465 views
“Friend” stole SD card. Tracing an SD card?
First off, let me say that I currently live in Mexico, a land filled with petty theft. I had a group of friends over last night, and they were looking at the photos on my camera. Today, I looked at my ...
8
votes
3answers
2k views
Using RFID-only on door lock to house?
I'm thinking of equipping the door to my house with an RFID-reader and a custom arduino-like board to do the authentication.
My question is what is the recommended security level for a normal house ...
8
votes
4answers
337 views
Best practices for physically securing a notebook
If the user knows that other people will repeatedly have physical access to her notebook - running Linux - while she is absent, and that there is no way around this, what are best practices for ...
8
votes
1answer
336 views
How to apply IT Security knowledge to Home Security?
Today my car got stolen from my house, and it is possible the person who did it has access to my home. I try to take secure measures online to maintain security, yet it seems I never paid attention to ...
7
votes
4answers
297 views
How to test a physical machine?
In two weeks time, I will have to test a couple of computers that a client would like to provide to its employees. The main concern is making sure that the employees won't be able to use those ...
7
votes
3answers
254 views
Securing a LAN without Physical Security
I've got an interesting dilemma. I have a large (50+ users) office that is going to be on the campus of a local university. The purpose is to foster collaboration, etc, but the open environment is ...
6
votes
7answers
2k views
Physical computer security, how to disable USB ports when the computer is 'locked'?
Lets say my PC & server is in an environment where a theoretical attacker has physical access to the machine while I'm not there. Now the data is encrypted on the hard drive with TrueCrypt. ...
6
votes
6answers
496 views
Is it safe to use virtual machines when examining malware?
We want to study for the CEH program and have downloaded 12 DVDs that 6 DVDs are software key-loggers, Trojans, etc. that are all detected by antivirus. This prevents us from examining them and ...
6
votes
4answers
146 views
How to choose/compromise between data protection, and device recovery?
I'm sure many of you have probably seen (online or in-person) the DEFCON 18 presentation, demonstrating what can happen if you steal a hacker's computer. For those who haven't, the link is below. ...
6
votes
3answers
148 views
Requiring Authentication to Exit
I've often wondered why facilities do not require authentication as a default on exit. Beyond the oblivious reasons:
Fire safety policies would require a panic mechanism to override the access ...
6
votes
3answers
124 views
Securing mail deliveries in a multi-tenant office building
I am concerned that that postal mail (and other deliveries not requiring a signature) may be at risk from theft or unauthorised access. My company is based in a multi-tenant office with an unattended ...
6
votes
1answer
166 views
What is the difference between Simple Power Analysis and Differential Power Analysis?
What is the difference between Simple Power Analysis (SPA) and Differential Power Analysis (DPA) and why is it not possible to do an SPA attack on FPGAs?
My basic understanding is they are ...
5
votes
4answers
8k views
Can an employer access Whatsapp messages if you are using their servers?
Does anyone know if an employer can access whatsapp messages if you are using their servers? Whatsapp apparently say the messages are encrypted, but I'm not sure about this.
5
votes
3answers
603 views
What can a hacker do when he has physical access to a system?
I mean, I'm a tech guy here in my region (not a hacker...). When I sit in the front of another person's PC, I notice a little fear about what I can do in the system.
It's obvious that I will not ...
5
votes
1answer
508 views
access control to data-center using rfid
I don't know if "here" is the right place to make this kind of question...
so here it is..
Is rfid a good solution for controlling access to a data-center?
Because rfid is "wireless", is it ...
5
votes
1answer
337 views
Cutting and sniffing fiberoptic cables - time before detection?
Suppose you'd cut a fiberoptic cable with two razor sharp mirrors, reflecting the traffic out into your sniffing device and then back into the wire again. How fast would you need to get the traffic up ...
5
votes
3answers
501 views
How do I improve the physical security of a rack cabinet?
I've got an 8U 19-inch server rack cabinet with two locks - one on the front panel, one on the rear panel. The locks are small cam locks, but the cam part is rather thin and flimsy-looking.
I could ...
5
votes
3answers
185 views
Sourcing hardware that is least likely to contain backdoors
I understand that CPU silicon (for example) is scrutinized for backdoors but there are other aspects of a computer system that may "leak data" to the outside world unbeknownst to the owner regardless ...
5
votes
1answer
78 views
Security differences between Passive and Active RFID tags
Most people are aware there are two types of RFID tags, active tags (ones that contain a power source of some kind) and passive tags (ones that are powered by the RF field).
I'd like to know if ...
4
votes
3answers
221 views
Live Linux which does not mount any hard drive in the computer
I am searching for a Linux System which runs from a CD and does not mount any hard drive of the computer.
I want to prevent any possiblity to write something on the hard drive of the computer and on ...
4
votes
2answers
764 views
How easily could be truecrypt and EFS cracked in this scenario
I suspect some info was subtracted in the past months from my laptop. Therefore Im looking for methods to encrypt my data. I want to try using truecrypt for the sensitive files folder plus EFS for ...
4
votes
4answers
111 views
Block unauthorized user from getting access to intranet
What's the common way to block users from accessing intranet?
Right now, whoever plugs in a cable can access any intranet server freely. I want to change this behavior. But given that we run not only ...
4
votes
2answers
516 views
How does syskey in Windows increase the security in a domain?
I use syskey in windows XP and Windows 7. I've read Microsoft's article but I have questions.
How does this solution increase security?
What are differences between using Syskey in a client that ...
3
votes
4answers
243 views
Help to account all the points of physical access to a rack server to steal software
Let's say I want to move my 1U Dell server to co-location site with a hostile company who will try to steal my code (this is almost 90% probability if I dont take steps)...
The limitation for their ...
3
votes
4answers
213 views
Is there a security device to register unauthorised physical access?
I understand that it is not possible to secure your software if a third party has physical access to the box (eg colo). So may be I can install some sort of hardware (like a seal) which only need to ...
3
votes
3answers
280 views
Is there is a way to lock my USB port over the device physically?
Is there is a way to lock my USB port over the device physically ?
For example I am connecting the USB mouse and keyboard on an public computer but I do not want anyone to remove them physically. I ...
3
votes
2answers
107 views
What value security wise, if any, does a digital handwritten signature have?
Here's an example of what I mean:
(It's basically the same thing as a traditional signature.)
Given I've never seen someone fail this control, it's unclear to me what real security such a system ...
3
votes
3answers
417 views
Physical laptop lock
I brought this really great laptop, but I cannot find something that I can lock the laptop physically to the desk or prevent a thief from grabbing this laptop.
There is no "universal" hole there that ...
